CVE-2010-3838

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

MySQL 5.0 before 5.0.92, 5.1 before 5.1.51, and 5.5 before 5.5.6 allows remote authenticated users to cause a denial of service (server crash) via a query that uses the (1) GREATEST or (2) LEAST function with a mixed list of numeric and LONGBLOB arguments, which is not properly handled when the function's result is "processed using an intermediate temporary table."

References

http://bugs.mysql.com/bug.php?id=54461

http://dev.mysql.com/doc/refman/5.0/en/news-5-0-92.html

http://dev.mysql.com/doc/refman/5.1/en/news-5-1-51.html

http://dev.mysql.com/doc/refman/5.5/en/news-5-5-6.html

http://lists.apple.com/archives/security-announce/2011//Jun/msg00000.html

http://secunia.com/advisories/42875

http://secunia.com/advisories/42936

http://support.apple.com/kb/HT4723

http://www.debian.org/security/2011/dsa-2143

http://www.mandriva.com/security/advisories?name=MDVSA-2010:222

http://www.mandriva.com/security/advisories?name=MDVSA-2010:223

http://www.redhat.com/support/errata/RHSA-2010-0825.html

http://www.redhat.com/support/errata/RHSA-2011-0164.html

http://www.securityfocus.com/bid/43676

http://www.turbolinux.co.jp/security/2011/TLSA-2011-3j.txt

http://www.ubuntu.com/usn/USN-1017-1

http://www.ubuntu.com/usn/USN-1397-1

http://www.vupen.com/english/advisories/2011/0105

http://www.vupen.com/english/advisories/2011/0170

http://www.vupen.com/english/advisories/2011/0345

https://bugzilla.redhat.com/show_bug.cgi?id=640858

https://exchange.xforce.ibmcloud.com/vulnerabilities/64840

Details

Source: MITRE

Published: 2011-01-14

Updated: 2019-12-17

Risk Information

CVSS v2

Base Score: 4

Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P

Impact Score: 2.9

Exploitability Score: 8

Severity: MEDIUM

Vulnerable Software

Configuration 1

OR

cpe:2.3:a:mysql:mysql:5.1.5:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.23:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.31:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.32:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.34:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.1.37:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.7:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.8:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.9:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.10:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.11:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.12:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.13:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.14:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.15:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.16:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.17:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.18:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.19:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.20:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.21:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.22:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.23:a:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.24:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.25:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.26:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.27:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.28:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.29:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.30:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.31:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.33:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.34:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.35:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.36:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.37:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.38:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.39:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.40:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.40:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.41:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.42:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.43:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.43:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.44:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.45:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.46:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.46:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.47:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.48:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.49:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.49:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.1.50:*:*:*:*:*:*:*

Configuration 2

OR

cpe:2.3:a:oracle:mysql:5.5.0:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.5.1:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.5.2:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.5.3:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.5.4:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.5.5:*:*:*:*:*:*:*

Configuration 3

OR

cpe:2.3:a:mysql:mysql:5.0.0:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.2:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.3:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.4:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.5:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.5.0.21:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.10:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.15:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.16:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.17:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.20:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.22.1.0.1:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.24:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.30:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.36:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.44:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.45b:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.54:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.56:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.60:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.66:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.82:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.84:*:*:*:*:*:*:*

cpe:2.3:a:mysql:mysql:5.0.87:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.0:alpha:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.3:beta:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.6:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.7:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.8:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.9:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.11:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.12:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.13:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.14:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.18:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.19:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.21:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.22:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.23:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.25:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.26:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.27:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.30:sp1:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.32:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.33:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.37:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.38:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.41:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.42:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.45:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.50:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.51:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.52:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.67:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.75:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.77:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.81:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.83:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.85:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.86:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.88:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.89:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.90:*:*:*:*:*:*:*

cpe:2.3:a:oracle:mysql:5.0.91:*:*:*:*:*:*:*

Tenable Plugins

View all (30 total)

IDNameProductFamilySeverity
75905openSUSE Security Update : libmysqlclusterclient16 (openSUSE-SU-2011:0799-1)NessusSuSE Local Security Checks
medium
75904openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2011:1250-1)NessusSuSE Local Security Checks
medium
75898openSUSE Security Update : libmariadbclient16 (openSUSE-SU-2011:0743-1)NessusSuSE Local Security Checks
medium
75590openSUSE Security Update : libmysqlclusterclient16 (openSUSE-SU-2011:0774-1)NessusSuSE Local Security Checks
medium
75589openSUSE Security Update : libmysqlclient-devel (openSUSE-SU-2011:1250-1)NessusSuSE Local Security Checks
medium
75582openSUSE Security Update : libmariadbclient16 (openSUSE-SU-2011:0743-1)NessusSuSE Local Security Checks
medium
68184Oracle Linux 6 : mysql (ELSA-2011-0164)NessusOracle Linux Local Security Checks
medium
68134Oracle Linux 5 : mysql (ELSA-2010-0825)NessusOracle Linux Local Security Checks
medium
60940Scientific Linux Security Update : mysql on SL6.x i386/x86_64NessusScientific Linux Local Security Checks
medium
60884Scientific Linux Security Update : mysql on SL5.x i386/x86_64NessusScientific Linux Local Security Checks
medium
58325Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1397-1)NessusUbuntu Local Security Checks
high
17836MySQL < 5.5.6 Multiple Denial of ServiceNessusDatabases
medium
17834MySQL < 5.0.92 Multiple Denial of ServiceNessusDatabases
medium
57446GLSA-201201-02 : MySQL: Multiple vulnerabilitiesNessusGentoo Local Security Checks
high
57115SuSE 11.1 Security Update : MySQL (SAT Patch Number 5285)NessusSuSE Local Security Checks
medium
57114SuSE 11.1 Security Update : MySQL (SAT Patch Number 5285)NessusSuSE Local Security Checks
medium
55416Mac OS X 10.6.x < 10.6.8 Multiple VulnerabilitiesNessusMacOS X Local Security Checks
critical
55415Mac OS X Multiple Vulnerabilities (Security Update 2011-004)NessusMacOS X Local Security Checks
high
800790Mac OS X 10.6 < 10.6.8 Multiple VulnerabilitiesLog Correlation EngineOperating System Detection
high
5968Mac OS X 10.6 < 10.6.8 Multiple VulnerabilitiesNessus Network MonitorGeneric
critical
51571RHEL 6 : mysql (RHSA-2011:0164)NessusRed Hat Local Security Checks
medium
51530Debian DSA-2143-1 : mysql-dfsg-5.0 - several vulnerabilitiesNessusDebian Local Security Checks
medium
50806CentOS 5 : mysql (CESA-2010:0825)NessusCentOS Local Security Checks
medium
50573Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : mysql-5.1, mysql-dfsg-5.0, mysql-dfsg-5.1 vulnerabilities (USN-1017-1)NessusUbuntu Local Security Checks
medium
50534Mandriva Linux Security Advisory : mysql (MDVSA-2010:223)NessusMandriva Local Security Checks
medium
50533Mandriva Linux Security Advisory : mysql (MDVSA-2010:222)NessusMandriva Local Security Checks
medium
50474RHEL 5 : mysql (RHSA-2010:0825)NessusRed Hat Local Security Checks
medium
801142MySQL Community Server 5.1 < 5.1.51 Multiple Denial of Service VulnerabilitiesLog Correlation EngineDatabase
medium
5677MySQL Community Server 5.1 < 5.1.51 Multiple Denial of Service VulnerabilitiesNessus Network MonitorDatabase
medium
49711MySQL Community Server < 5.1.51 Multiple VulnerabilitiesNessusDatabases
medium